@jskit-ai/users-web 0.1.162 → 0.1.164

package/package.descriptor.mjs

@@ -3,7 +3,7 @@ import { HOME_COG_OUTLET } from "./src/shared/toolsOutletContracts.js";
 export default Object.freeze({
   packageVersion: 1,
   packageId: "@jskit-ai/users-web",
-  version: "0.1.162",
+  version: "0.1.164",
   kind: "runtime",
   description: "Users web module: account/profile UI plus shared users web widgets.",
   dependsOn: [
@@ -286,12 +286,12 @@ export default Object.freeze({
     dependencies: {
       runtime: {
         "@mdi/js": "^7.4.47",
-        "@jskit-ai/http-runtime": "0.1.143",
-        "@jskit-ai/realtime": "0.1.142",
-        "@jskit-ai/kernel": "0.1.145",
-        "@jskit-ai/shell-web": "0.1.146",
-        "@jskit-ai/uploads-image-web": "0.1.121",
-        "@jskit-ai/users-core": "0.1.158"
+        "@jskit-ai/http-runtime": "0.1.145",
+        "@jskit-ai/realtime": "0.1.143",
+        "@jskit-ai/kernel": "0.1.146",
+        "@jskit-ai/shell-web": "0.1.147",
+        "@jskit-ai/uploads-image-web": "0.1.122",
+        "@jskit-ai/users-core": "0.1.160"
       },
       dev: {}
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/users-web",
-  "version": "0.1.162",
+  "version": "0.1.164",
   "type": "module",
   "scripts": {
     "test": "node --test"
@@ -31,6 +31,7 @@
     "./client/composables/useList": "./src/client/composables/records/useList.js",
     "./client/composables/useCrudList": "./src/client/composables/records/useCrudList.js",
     "./client/composables/useCrudListScreen": "./src/client/composables/useCrudListScreen.js",
+    "./client/crudHttpClient": "./src/client/composables/crud/crudHttpClientSupport.js",
     "./client/composables/useCrudListParentTitle": "./src/client/composables/useCrudListParentTitle.js",
     "./client/composables/useRealtimeQueryInvalidation": "./src/client/composables/useRealtimeQueryInvalidation.js",
     "./client/composables/useSurfaceRouteContext": "./src/client/composables/useSurfaceRouteContext.js",
@@ -46,12 +47,12 @@
   },
   "dependencies": {
     "@mdi/js": "^7.4.47",
-    "@jskit-ai/http-runtime": "0.1.143",
-    "@jskit-ai/kernel": "0.1.145",
-    "@jskit-ai/realtime": "0.1.142",
-    "@jskit-ai/shell-web": "0.1.146",
-    "@jskit-ai/uploads-image-web": "0.1.121",
-    "@jskit-ai/users-core": "0.1.158"
+    "@jskit-ai/http-runtime": "0.1.145",
+    "@jskit-ai/kernel": "0.1.146",
+    "@jskit-ai/realtime": "0.1.143",
+    "@jskit-ai/shell-web": "0.1.147",
+    "@jskit-ai/uploads-image-web": "0.1.122",
+    "@jskit-ai/users-core": "0.1.160"
   },
   "peerDependencies": {
     "@tanstack/vue-query": "^5.90.5",

package/src/client/composables/crud/crudHttpClientSupport.js

@@ -0,0 +1,57 @@
+import { normalizeText } from "@jskit-ai/kernel/shared/support/normalize";
+import { getUsersWebHttpClient } from "../../lib/httpClient.js";
+
+const CRUD_API_ACCESS_AUTHENTICATED = "authenticated";
+const CRUD_API_ACCESS_PUBLIC = "public";
+const CRUD_API_ACCESS_VALUES = Object.freeze([
+  CRUD_API_ACCESS_AUTHENTICATED,
+  CRUD_API_ACCESS_PUBLIC
+]);
+const publicCrudClients = new WeakSet();
+
+function normalizeCrudApiAccess(value = "") {
+  const normalized = normalizeText(value).toLowerCase() || CRUD_API_ACCESS_AUTHENTICATED;
+  if (CRUD_API_ACCESS_VALUES.includes(normalized)) {
+    return normalized;
+  }
+
+  throw new TypeError(
+    `CRUD resource apiAccess must be one of: ${CRUD_API_ACCESS_VALUES.join(", ")}. ` +
+      `Received: ${String(value || "") || "(empty)"}`
+  );
+}
+
+function resolveCrudHttpClient(resource = null, { client = null } = {}) {
+  const activeClient = client || getUsersWebHttpClient();
+  if (!activeClient || typeof activeClient.request !== "function") {
+    throw new TypeError("resolveCrudHttpClient requires a client with request().");
+  }
+
+  if (normalizeCrudApiAccess(resource?.apiAccess) !== CRUD_API_ACCESS_PUBLIC) {
+    return activeClient;
+  }
+  if (publicCrudClients.has(activeClient)) {
+    return activeClient;
+  }
+
+  const publicClient = Object.freeze({
+    request(url, options = {}) {
+      const requestOptions = options && typeof options === "object" && !Array.isArray(options)
+        ? options
+        : {};
+      return activeClient.request(url, {
+        ...requestOptions,
+        csrf: false
+      });
+    }
+  });
+  publicCrudClients.add(publicClient);
+  return publicClient;
+}
+
+export {
+  CRUD_API_ACCESS_AUTHENTICATED,
+  CRUD_API_ACCESS_PUBLIC,
+  normalizeCrudApiAccess,
+  resolveCrudHttpClient
+};

package/src/client/composables/crud/crudSchemaFormHelpers.js

@@ -115,6 +115,37 @@ function toDateTimeLocalInputValue(value) {
   ].join("-") + `T${padDateTimePart(date.getHours())}:${padDateTimePart(date.getMinutes())}`;
 }
 
+function toDateInputValue(value) {
+  if (value == null || value === "") {
+    return "";
+  }
+
+  if (value instanceof Date) {
+    return Number.isNaN(value.getTime())
+      ? String(value)
+      : value.toISOString().slice(0, 10);
+  }
+
+  const normalized = String(value).trim();
+  if (!normalized) {
+    return "";
+  }
+
+  const calendarDateMatch = normalized.match(/^(\d{4}-\d{2}-\d{2})(?:$|[T\s])/u);
+  if (calendarDateMatch) {
+    const calendarDate = calendarDateMatch[1];
+    const parsedCalendarDate = new Date(`${calendarDate}T00:00:00.000Z`);
+    if (
+      !Number.isNaN(parsedCalendarDate.getTime()) &&
+      parsedCalendarDate.toISOString().slice(0, 10) === calendarDate
+    ) {
+      return calendarDate;
+    }
+  }
+
+  return normalized;
+}
+
 function toIsoUtcDateTimeValue(value) {
   const normalized = String(value ?? "").trim();
   if (!normalized) {
@@ -299,6 +330,11 @@ function applyCrudPayloadToForm(fields = [], model = {}, payload = {}) {
       continue;
     }
 
+    if (fieldFormat === "date") {
+      targetModel[fieldKey] = toDateInputValue(rawValue);
+      continue;
+    }
+
     if (fieldFormat === "date-time") {
       targetModel[fieldKey] = toDateTimeLocalInputValue(rawValue);
       continue;

package/src/client/composables/records/useCrudAddEdit.js

@@ -2,6 +2,7 @@ import { computed, proxyRefs, reactive, watch } from "vue";
 import { useRoute, useRouter } from "vue-router";
 import { asPlainObject } from "../support/scopeHelpers.js";
 import { resolveCrudJsonApiTransport } from "../crud/crudJsonApiTransportSupport.js";
+import { resolveCrudHttpClient } from "../crud/crudHttpClientSupport.js";
 import { useAddEdit } from "./useAddEdit.js";
 import {
   resolveCrudBoundValues,
@@ -186,6 +187,9 @@ function useCrudAddEdit({
   const addEdit = useAddEdit({
     ...normalizedAddEditOptions,
     resource: resolvedResource,
+    client: resolveCrudHttpClient(resolvedResource, {
+      client: normalizedAddEditOptions.client
+    }),
     transport: resolvedTransport,
     model: form,
     fieldErrorKeys,

package/src/client/composables/records/useCrudList.js

@@ -1,6 +1,7 @@
 import { computed, unref } from "vue";
 import { useRoute } from "vue-router";
 import { resolveCrudJsonApiTransport } from "../crud/crudJsonApiTransportSupport.js";
+import { resolveCrudHttpClient } from "../crud/crudHttpClientSupport.js";
 import {
   resolveLookupFieldDisplayValue,
   resolveRecordTitle
@@ -71,6 +72,9 @@ function useCrudList({
   });
   const records = useList({
     ...listOptions,
+    client: resolveCrudHttpClient(resource, {
+      client: listOptions.client
+    }),
     transport: resolveCrudJsonApiTransport(listOptions.transport, resource, {
       mode: "list"
     }),

package/src/client/composables/records/useCrudView.js

@@ -3,6 +3,7 @@ import { useRoute } from "vue-router";
 import {
   resolveCrudJsonApiTransport
 } from "../crud/crudJsonApiTransportSupport.js";
+import { resolveCrudHttpClient } from "../crud/crudHttpClientSupport.js";
 import {
   resolveLookupFieldDisplayValue,
   resolveRecordTitle
@@ -30,6 +31,9 @@ function useCrudView({
   const view = useView({
     ...viewOptions,
     resource,
+    client: resolveCrudHttpClient(resource, {
+      client: viewOptions.client
+    }),
     transport: resolveCrudJsonApiTransport(viewOptions.transport, resource, {
       mode: "view"
     }),

package/src/client/composables/useCommand.js

@@ -9,6 +9,7 @@ import {
   setupRouteChangeCleanup,
   setupOperationErrorReporting
 } from "./runtime/operationUiHelpers.js";
+import { resolveCrudHttpClient } from "./crud/crudHttpClientSupport.js";
 
 function useCommand({
   ownershipFilter = ROUTE_VISIBILITY_WORKSPACE,
@@ -18,6 +19,7 @@ function useCommand({
   runPermissions = [],
   writeMethod = "POST",
   client = null,
+  resource: commandResource = null,
   transport = null,
   placementSource = "users-web.command",
   fallbackRunError = "Unable to complete action.",
@@ -50,10 +52,10 @@ function useCommand({
   const routeContext = operationScope.routeContext;
   const canRun = operationScope.permissionGate("run");
 
-  const resource = useEndpointResource({
+  const endpointResource = useEndpointResource({
     path: operationScope.apiPath,
     enabled: false,
-    client,
+    client: resolveCrudHttpClient(commandResource, { client }),
     writeMethod,
     transport,
     fallbackSaveError: fallbackRunError
@@ -66,7 +68,7 @@ function useCommand({
 
   const command = useCommandCore({
     model,
-    resource,
+    resource: endpointResource,
     writeMethod,
     canRun,
     fieldBag,
@@ -109,7 +111,7 @@ function useCommand({
     message: command.message,
     messageType: command.messageType,
     run: command.run,
-    resource
+    resource: endpointResource
   });
 }
 

package/src/client/composables/useCrudListScreen.js

@@ -3,6 +3,15 @@ import { useCrudList } from "./records/useCrudList.js";
 import { useCrudListBulkActions } from "./useCrudListBulkActions.js";
 import { useCrudListFilters } from "./useCrudListFilters.js";
 import { useCrudListRowActions } from "./useCrudListRowActions.js";
+import { resolveCrudHttpClient } from "./crud/crudHttpClientSupport.js";
+
+function buildCrudListActionContext(records, client) {
+  return Object.freeze({
+    records,
+    reload: records.reload,
+    client
+  });
+}
 
 function formatCrudListCardValue(value) {
   if (value === null || value === undefined || value === "") {
@@ -102,6 +111,7 @@ function createCrudListDisplayRow(record = {}, index = 0, records = {}) {
 
 function useCrudListScreen({
   adapter = null,
+  client = null,
   resource = null,
   resourceNamespace = "resource",
   apiSuffix = "",
@@ -123,6 +133,7 @@ function useCrudListScreen({
   requestRecoveryLabel = "Records",
   fallbackLoadError = "Unable to load records."
 } = {}) {
+  const crudHttpClient = resolveCrudHttpClient(resource, { client });
   const filterRuntime = useCrudListFilters(listFilters);
   const normalizedRecordChangedEvents = Array.isArray(recordChangedEvents)
     ? recordChangedEvents
@@ -130,6 +141,7 @@ function useCrudListScreen({
   const normalizedResourceNamespace = String(resourceNamespace || "resource").trim() || "resource";
   const records = useCrudList({
     adapter: adapter || undefined,
+    client: crudHttpClient,
     resource,
     apiSuffix,
     queryKeyFactory: (surfaceId = "", workspaceSlug = "") => [
@@ -184,17 +196,11 @@ function useCrudListScreen({
   );
   const bulkActions = useCrudListBulkActions(listBulkActions, {
     resolveRecordId: (record, index) => records.resolveRowKey(record, index),
-    resolveContext: () => ({
-      records,
-      reload: records.reload
-    })
+    resolveContext: () => buildCrudListActionContext(records, crudHttpClient)
   });
   const rowActions = useCrudListRowActions(listRowActions, {
     resolveRecordId: (record, index) => records.resolveRowKey(record, index),
-    resolveContext: () => ({
-      records,
-      reload: records.reload
-    })
+    resolveContext: () => buildCrudListActionContext(records, crudHttpClient)
   });
   const listPrimaryAction = computed(() =>
     newUrlTemplate ? records.resolveParams(newUrlTemplate) : ""
@@ -224,4 +230,8 @@ function useCrudListScreen({
   });
 }
 
-export { useCrudListScreen };
+const __testables = Object.freeze({
+  buildCrudListActionContext
+});
+
+export { __testables, useCrudListScreen };

package/src/client/index.js

@@ -7,6 +7,10 @@ export { default as CrudListBulkActionSurface } from "./components/CrudListBulkA
 export { default as CrudListFilterSurface } from "./components/CrudListFilterSurface.vue";
 export { default as CrudListScreen } from "./components/CrudListScreen.vue";
 export { default as CrudViewScreen } from "./components/CrudViewScreen.vue";
+export {
+  normalizeCrudApiAccess,
+  resolveCrudHttpClient
+} from "./composables/crud/crudHttpClientSupport.js";
 
 const clientProviders = Object.freeze([UsersWebClientProvider]);
 

package/test/crudHttpClientSupport.test.js

@@ -0,0 +1,77 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import {
+  normalizeCrudApiAccess,
+  resolveCrudHttpClient
+} from "../src/client/composables/crud/crudHttpClientSupport.js";
+import {
+  __testables as crudListScreenTestables
+} from "../src/client/composables/useCrudListScreen.js";
+
+test("resolveCrudHttpClient injects per-request CSRF opt-out for public resources", async () => {
+  const calls = [];
+  const configuredClient = {
+    async request(url, options) {
+      calls.push([url, options]);
+      return { ok: true };
+    }
+  };
+  const client = resolveCrudHttpClient({ apiAccess: "public" }, {
+    client: configuredClient
+  });
+
+  for (const method of ["POST", "PATCH", "DELETE"]) {
+    await client.request("/api/books/1", {
+      method,
+      csrf: true
+    });
+  }
+
+  assert.deepEqual(
+    calls.map(([url, options]) => [url, options.method, options.csrf]),
+    [
+      ["/api/books/1", "POST", false],
+      ["/api/books/1", "PATCH", false],
+      ["/api/books/1", "DELETE", false]
+    ]
+  );
+});
+
+test("resolveCrudHttpClient preserves the configured client for authenticated resources", () => {
+  const configuredClient = {
+    request() {}
+  };
+
+  assert.equal(
+    resolveCrudHttpClient({ apiAccess: "authenticated" }, { client: configuredClient }),
+    configuredClient
+  );
+  assert.equal(
+    resolveCrudHttpClient({}, { client: configuredClient }),
+    configuredClient
+  );
+  assert.equal(normalizeCrudApiAccess(""), "authenticated");
+  assert.throws(
+    () => resolveCrudHttpClient({ apiAccess: "always" }, { client: configuredClient }),
+    /apiAccess must be one of: authenticated, public/
+  );
+});
+
+test("CRUD list row and bulk action context carries the resource-aware client", () => {
+  const records = {
+    reload() {}
+  };
+  const client = {
+    request() {}
+  };
+
+  assert.deepEqual(
+    crudListScreenTestables.buildCrudListActionContext(records, client),
+    {
+      records,
+      reload: records.reload,
+      client
+    }
+  );
+});

package/test/exportsContract.test.js

@@ -39,6 +39,7 @@ test("users-web exports are explicit and aligned with production/template usage"
       "./client/composables/useCrudListFilters",
       "./client/composables/useCrudList",
       "./client/composables/useCrudListScreen",
+      "./client/crudHttpClient",
       "./client/composables/useCrudView",
       "./client/composables/useCrudViewScreen",
       "./client/lib/httpClient"

package/test/requestTransportOptions.test.js

@@ -403,3 +403,55 @@ test("commands use the configured users-web HTTP client by default", async () =>
     resetUsersWebHttpClientForTests();
   }
 });
+
+test("commands use public CRUD resource access without a CSRF session preflight", async () => {
+  const queryClient = new QueryClient();
+  const calls = [];
+  let command = null;
+  configureUsersWebHttpClient({
+    fetchImpl: async (url, options) => {
+      calls.push([url, options]);
+      return {
+        ok: true,
+        status: 204,
+        headers: {
+          get() {
+            return "";
+          }
+        },
+        async json() {
+          return {};
+        }
+      };
+    }
+  });
+
+  try {
+    const app = createSSRApp({
+      setup() {
+        command = useCommand({
+          access: "always",
+          apiSuffix: "/books/1",
+          writeMethod: "DELETE",
+          resource: {
+            apiAccess: "public"
+          }
+        });
+        return () => h("div");
+      }
+    });
+    app.use(VueQueryPlugin, {
+      queryClient
+    });
+    await renderToString(app);
+
+    await command.run();
+
+    assert.equal(calls.length, 1);
+    assert.equal(calls[0][0], "/api/books/1");
+    assert.equal(calls[0][1].method, "DELETE");
+    assert.equal(Object.hasOwn(calls[0][1], "csrf"), false);
+  } finally {
+    resetUsersWebHttpClientForTests();
+  }
+});

package/test/useCrudAddEdit.test.js

@@ -108,6 +108,35 @@ test("buildCrudFormPayload and applyCrudPayloadToForm round-trip date-time field
   assert.equal(form.scheduledAt, "2024-01-02T03:04");
 });
 
+test("applyCrudPayloadToForm normalizes date values for HTML date inputs", () => {
+  const fields = [
+    { key: "publishedOn", type: "string", format: "date" },
+    { key: "reviewedOn", type: "string", format: "date" },
+    { key: "archivedOn", type: "string", format: "date" },
+    { key: "invalidOn", type: "string", format: "date" }
+  ];
+  const form = reactive({
+    publishedOn: "",
+    reviewedOn: "",
+    archivedOn: "",
+    invalidOn: ""
+  });
+
+  applyCrudPayloadToForm(fields, form, {
+    publishedOn: "2026-08-10",
+    reviewedOn: "2026-08-11T00:00:00.000Z",
+    archivedOn: new Date("2026-08-12T00:00:00.000Z"),
+    invalidOn: "not-a-date"
+  });
+
+  assert.deepEqual(form, {
+    publishedOn: "2026-08-10",
+    reviewedOn: "2026-08-11",
+    archivedOn: "2026-08-12",
+    invalidOn: "not-a-date"
+  });
+});
+
 test("buildCrudFormPayload normalizes time fields to canonical HH:MM", () => {
   const fields = [
     { key: "fromTime", type: "string", format: "time" },